 Florian Roth
|
ce750aba9c
|
fix: wrong condition
|
2022-10-31 17:38:04 +01:00 |
|
|
Florian Roth
|
b17777751e
|
Merge branch 'master' into aurora-false-positive-fixing
|
2022-10-31 15:53:53 +01:00 |
|
|
phantinuss
|
743ebf08f7
|
Merge pull request #3660 from qasimqlf/patch-10
Title Fix
|
2022-10-31 11:53:46 +01:00 |
|
|
Florian Roth
|
711844ea93
|
fix: Visual Studio Builds
|
2022-10-31 11:48:24 +01:00 |
|
|
phantinuss
|
8c2b14a7ab
|
Merge pull request #3661 from phantinuss/master
FP fixes
|
2022-10-31 11:44:39 +01:00 |
|
|
phantinuss
|
0d63c5a4ff
|
fix: modified should change on title changes
https://github.com/SigmaHQ/sigma/wiki/Rule-Creation-Guide#date
|
2022-10-31 11:44:16 +01:00 |
|
|
phantinuss
|
a20789cc49
|
Merge pull request #3654 from SigmaHQ/aurora-false-positive-fixing
fix: FP with Code Integrity Attempted DLL Load
|
2022-10-31 11:35:56 +01:00 |
|
|
phantinuss
|
1f9a833b9b
|
fix: no modified date for changes on meta data
|
2022-10-31 11:34:08 +01:00 |
|
|
phantinuss
|
2788fba40d
|
fix: FPs found with Aurora
|
2022-10-31 11:31:30 +01:00 |
|
|
Qasim Qlf
|
b3c0301bde
|
Title Fix
|
2022-10-31 15:23:05 +05:00 |
|
|
phantinuss
|
91af76417b
|
fix: new code integrity offenders
|
2022-10-31 11:13:56 +01:00 |
|
|
frack113
|
095bc89545
|
Update proc_creation_win_susp_vslsagent_agentextensionpath_load.yml
change to LF
|
2022-10-31 08:49:16 +01:00 |
|
|
frack113
|
5c416e94cf
|
Update proc_creation_win_susp_vslsagent_agentextensionpath_load.yml
|
2022-10-31 08:20:41 +01:00 |
|
|
bohops
|
c0e98d352a
|
Add vsls-agent lolbin rule
|
2022-10-30 17:06:37 -04:00 |
|
|
Florian Roth
|
897580f294
|
Update win_codeintegrity_attempted_dll_load.yml
|
2022-10-29 09:52:36 +02:00 |
|
|
frack113
|
c1c4ef0f9c
|
Merge pull request #3655 from nasbench/nasbench-rule-devel
Rule Dev
|
2022-10-29 09:39:12 +02:00 |
|
|
frack113
|
15d7855c1c
|
Merge pull request #3656 from nasbench/fix-false-positives
fix: FP with dbgcore and dbghelp
|
2022-10-29 09:38:05 +02:00 |
|
|
Mustafa Kaan Demir
|
27822a0827
|
DomainPasswordSpray Attacks Rule
|
2022-10-29 09:36:40 +02:00 |
|
|
Nasreddine Bencherchali
|
ff3d576a1a
|
Fix small typos
|
2022-10-28 23:51:43 +02:00 |
|
|
Nasreddine Bencherchali
|
9c10585a34
|
fix: fix fp in testing
|
2022-10-28 18:11:30 +02:00 |
|
|
Nasreddine Bencherchali
|
fd256717b0
|
Update proc_creation_win_msiexec_install_quiet.yml
|
2022-10-28 18:03:47 +02:00 |
|
|
Nasreddine Bencherchali
|
012e10a8be
|
Update proc_creation_win_raspberry_robin_single_dot_ending_file.yml
|
2022-10-28 17:51:46 +02:00 |
|
|
Nasreddine Bencherchali
|
ae2f3ea66d
|
Add examples
|
2022-10-28 17:51:26 +02:00 |
|
|
Nasreddine Bencherchali
|
d6e076658d
|
Update after merge
|
2022-10-28 17:42:57 +02:00 |
|
|
Nasreddine Bencherchali
|
c21524b249
|
Merge branch 'nasbench-rule-devel' of https://github.com/nasbench/sigma into nasbench-rule-devel
|
2022-10-28 17:37:54 +02:00 |
|
|
Nasreddine Bencherchali
|
761bf551b1
|
Add more system processes
|
2022-10-28 17:25:53 +02:00 |
|
|
Nasreddine Bencherchali
|
bb8d7b3414
|
Add more suspicious extensions
|
2022-10-28 17:25:41 +02:00 |
|
|
Nasreddine Bencherchali
|
3cb577ddfc
|
Raspberry Robin Related Rules
|
2022-10-28 17:25:25 +02:00 |
|
|
Florian Roth
|
07cf7ae5fa
|
fix: FP with Code Integrity Attempted DLL Load
|
2022-10-28 16:28:49 +02:00 |
|
|
frack113
|
1f8e37351e
|
order yaml
|
2022-10-28 15:06:36 +02:00 |
|
|
Nasreddine Bencherchali
|
9d8cc243eb
|
Update description
|
2022-10-28 13:16:38 +02:00 |
|
|
Nasreddine Bencherchali
|
66b251604a
|
Add related field to new rule
|
2022-10-28 13:15:10 +02:00 |
|
|
Nasreddine Bencherchali
|
84a4b6ccb0
|
Rename
|
2022-10-28 13:14:35 +02:00 |
|
|
phantinuss
|
f004d27efe
|
fix: FP from testing environment
|
2022-10-28 11:39:53 +02:00 |
|
|
Gude5
|
a3e6856764
|
new rules: Sigma rules based on Elastic rules (#3632)
Co-authored-by: Nasreddine Bencherchali <8741929+nasbench@users.noreply.github.com>
|
2022-10-28 10:13:44 +02:00 |
|
|
phantinuss
|
f7319989e4
|
fix: new FP with Avast
|
2022-10-28 08:47:09 +02:00 |
|
|
frack113
|
625f05df3c
|
Merge pull request #3646 from nasbench/nasbench-rule-devel
Rule Dev
|
2022-10-28 06:34:48 +02:00 |
|
|
Nasreddine Bencherchali
|
8e3d1fa653
|
Update web_win_webshells_in_access_logs.yml
|
2022-10-27 14:13:12 +02:00 |
|
|
Nasreddine Bencherchali
|
aeefa4c022
|
Merge branch 'master' into fix-false-positives
|
2022-10-27 11:49:52 +02:00 |
|
|
Nasreddine Bencherchali
|
ca9183c1fe
|
Update process_access_win_shellcode_inject_msf_empire.yml
|
2022-10-27 11:39:58 +02:00 |
|
|
Nasreddine Bencherchali
|
308ab94f88
|
Update process_access_win_shellcode_inject_msf_empire.yml
|
2022-10-27 11:39:32 +02:00 |
|
|
phantinuss
|
07faf2b50a
|
fix: add missing \
|
2022-10-27 10:22:49 +02:00 |
|
|
phantinuss
|
152f22ba01
|
fix: FPs in testing environment
|
2022-10-27 09:46:05 +02:00 |
|
|
Nasreddine Bencherchali
|
2aff1acccd
|
Fix typo in selection
|
2022-10-27 00:12:58 +02:00 |
|
|
Nasreddine Bencherchali
|
4be6af3c08
|
Add/Update PAExec Rules
|
2022-10-26 23:27:17 +02:00 |
|
|
Nasreddine Bencherchali
|
c2045d6a91
|
Update web_win_webshells_in_access_logs.yml
|
2022-10-26 23:18:08 +02:00 |
|
|
Nasreddine Bencherchali
|
efe0cf5871
|
Add/Update Exchange/Mailbox Rules
|
2022-10-26 23:17:54 +02:00 |
|
|
Nasreddine Bencherchali
|
6f4250e434
|
Rename Service Install Rules
|
2022-10-26 23:17:02 +02:00 |
|
|
Nasreddine Bencherchali
|
388624e279
|
Update PsExec Rules
|
2022-10-26 23:15:01 +02:00 |
|
|
Nasreddine Bencherchali
|
d88ae70256
|
Rename Rule
Renamed the rule to follow the folder convention
|
2022-10-26 18:25:12 +02:00 |
|